Moonwell - R-Nemes's results

Lines of code

https://github.com/code-423n4/2023-07-moonwell/blob/fced18035107a345c31c9a9497d0da09105df4df/src/core/Oracles/ChainlinkOracle.sol#L97-L113

Vulnerability details

Impact

It is important to note that the Chainlink Price Oracle data feed aggregator incorporates two variables, namely minAnswer and maxAnswer values. These variables serve as bounds that prevent the aggregator from updating the latestAnswer value if it falls outside the agreed range of acceptable values.

However, it is crucial to understand that the contract application is still capable of reading the most recent answer from the Chainlink Price Oracle, regardless of whether it falls within the accepted range or not. This implies that the contract's borrowing functionality may utilize asset prices that fall outside the expected range, potentially leading to inaccurate calculations and incorrect borrowing decisions.

The impact of this situation can be significant. Borrowers relying on asset prices that deviate from the acceptable range may face increased risks and potential financial losses. It is crucial to carefully evaluate the implications of using data that falls outside the predefined bounds and consider implementing additional checks or alternative data sources to ensure the accuracy and reliability of asset pricing information.

Proof of Concept

chainlink docs The data feed aggregator includes both minAnswer and maxAnswer values. These variables prevent the aggregator from updating the latestAnswer outside the agreed range of acceptable values, but they do not stop your application from reading the most recent answer.

core/Oracles/ChainlinkOracle.sol#L97C1-L113C6

function getChainlinkPrice(
        AggregatorV3Interface feed
    ) internal view returns (uint256) {
        (, int256 answer, , uint256 updatedAt, ) = AggregatorV3Interface(feed)
            .latestRoundData();
        require(answer > 0, "Chainlink price cannot be lower than 0");
        require(updatedAt != 0, "Round is in incompleted state");

        // Chainlink USD-denominated feeds store answers at 8 decimals
        uint256 decimalDelta = uint256(18).sub(feed.decimals());
        // Ensure that we don't multiply the result by 0
        if (decimalDelta > 0) {
            return uint256(answer).mul(10 ** decimalDelta);
        } else {
            return uint256(answer);
        }
    }

Tools Used

Manual review

Recommended Mitigation Steps

getChainlinkPrice function should check the returned price is within some specied bounds and revert if the price is outside those values.

    function getChainlinkPrice(
        AggregatorV3Interface feed
    ) internal view returns (uint256) {
        (, int256 answer, , uint256 updatedAt, ) = AggregatorV3Interface(feed)
            .latestRoundData();
        require(answer > 0, "Chainlink price cannot be lower than 0");
        require(updatedAt != 0, "Round is in incompleted state");
		--->if (price >= maxPrice or price <= minPrice) revert();

        // Chainlink USD-denominated feeds store answers at 8 decimals
        uint256 decimalDelta = uint256(18).sub(feed.decimals());
        // Ensure that we don't multiply the result by 0
        if (decimalDelta > 0) {
            return uint256(answer).mul(10 ** decimalDelta);
        } else {
            return uint256(answer);
        }
    }

Assessed type

Invalid Validation